CVE-2026-48976

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0

Description An authenticated user can update a notifier belonging to another tenant by providing the target notifier UUID to the 'PUT /v1/notifiers/{id}' endpoint. This occurs because the NotifierRepository.Update function in backend/internal/data/repo/repo notifier.go calls UpdateOneID(id) without verifying if the record's user ID matches the authenticated user. An attacker can exploit this to read the returned stored URL, which may contain plaintext Shoutrrr credentials for services such as Slack, SMTP, Telegram, Pushover, or Discord, and can modify the URL to redirect notifications to an attacker-controlled webhook.

Recommendations Update HomeBox to version 0.26.0.